# Kibana rules and group by

**URL:** <https://discuss.elastic.co/t/kibana-rules-and-group-by/304572>\
**Category:** Kibana\
**Created:** [May 12, 2022, 12:28pm UTC](https://discuss.elastic.co/t/kibana-rules-and-group-by/304572 "2022-05-12T12:28:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ChristianOelsner](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\
**Post date:** [May 12, 2022, 12:28pm UTC](https://discuss.elastic.co/t/kibana-rules-and-group-by/304572/1 "2022-05-12T12:28:33Z")

</div>

Hi all,  
I am trying to create a rule/alert.  
The rule is working as inteded, but the mail notification is causing my troubles.  
Hopefully someone smarter than me can point me in the right direction.  
I am using the UI to create it, and to avoid posting pictures i will "handwrite my steps, in hopes that someone can guide me.  
It is a Log Threshold type rule.

```auto
WHEN THE count OG LOG ENTRIES
WITH data.cloudResources.resource.type MATCHES "USER_INVITATION"
AND data.request.data.user.email.keyword IS NOT " "@email.com
IS more than 1
FOR THE LAST 1 day
GROUP BY data.request.data.user.email.keyword

```

the email connector message section looks like this:

```auto
{{^context.isRatio}}{{#context.group}}{{context.group}} - {{/context.group}} Was
invited into MyConfluent Cloud{{/context.isRatio}}

```

And it give me a mail saying that whatever user is invited in to MyConfluent Cloud.  
However, i would like the mail to also contain the user who invited the new user.  
The user performing the invite in found in this field data.request.data.user.email.keyword  
But if i add that field to the group by section, it just send an email with the values of the 2 fields separated by a comma.

How can i format the mail body in a way that it says something like userA has invited userB into MyConfluent Cloud?

Best regards  
Oelsner

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [May 16, 2022, 12:30pm UTC](https://discuss.elastic.co/t/kibana-rules-and-group-by/304572/2 "2022-05-16T12:30:53Z")

</div>

> [@ChristianOelsner](#):
>
> But if i add that field to the group by section, it just send an email with the values of the 2 fields separated by a comma.

The behavior for expanding array values in mustache is just that - it returns the elements of the array, separated by a comma.

Though I guess it's not documented, apparently you can access array elements as if they were numeric property names; so `data.request.data.user.email.keyword.0` would expand to the first array element. At least according to this issue: [Accessing Array item by index in template · Issue #158 · janl/mustache.js · GitHub](https://github.com/janl/mustache.js/issues/158)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2022, 12:31pm UTC](https://discuss.elastic.co/t/kibana-rules-and-group-by/304572/3 "2022-06-13T12:31:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.